@vmz/core 0.3.12 → 0.3.13

package/dist/browser/dom/component.d.ts

@@ -1,4 +1,14 @@
 export declare function mount(Component: any, container: any, props?: any): Promise<any>;
+/**
+ * Root ownership for top-level creates (`mount` / `hydrate` / `resume`).
+ *
+ * Multi-root templates compile to a DocumentFragment; `appendChild` moves the
+ * children into the container and leaves the fragment empty and detached. The
+ * instance root must track the live container in that case — the same contract
+ * nested component hosts already follow (`nodeType === 11 ? host : node`) — or
+ * slot outlet searches and dispose walks run against a detached tree.
+ */
+export declare function adoptTopLevelDomRoot(inst: any, node: any, container: any): void;
 export declare function settlePendingChildMounts(inst: any): Promise<void>;
 export declare function runDirectCreate(Component: any, inst: any): any;
 export declare function findOwnedDefaultSlot(root: any): any;

package/dist/browser/dom/component.js

@@ -15,10 +15,7 @@ export async function mount(Component, container, props = {}) {
     inst.__vmzDepToBindings = Object.create(null);
     container.replaceChildren();
     const node = await createFromComponent(Component, inst);
-    if (node) {
-        inst.__vmzDomRoot = node;
-        container.appendChild(node);
-    }
+    adoptTopLevelDomRoot(inst, node, container);
     if (typeof inst.onMount === 'function') {
         await inst.onMount();
     }
@@ -26,6 +23,21 @@ export async function mount(Component, container, props = {}) {
     container.__vmzInst = inst;
     return inst;
 }
+/**
+ * Root ownership for top-level creates (`mount` / `hydrate` / `resume`).
+ *
+ * Multi-root templates compile to a DocumentFragment; `appendChild` moves the
+ * children into the container and leaves the fragment empty and detached. The
+ * instance root must track the live container in that case — the same contract
+ * nested component hosts already follow (`nodeType === 11 ? host : node`) — or
+ * slot outlet searches and dispose walks run against a detached tree.
+ */
+export function adoptTopLevelDomRoot(inst, node, container) {
+    if (!node)
+        return;
+    inst.__vmzDomRoot = node.nodeType === 11 ? container : node;
+    container.appendChild(node);
+}
 export async function settlePendingChildMounts(inst) {
     if (!inst || !Array.isArray(inst.__vmzPendingChildMounts) || !inst.__vmzPendingChildMounts.length)
         return;

package/dist/browser/dom/direct-api.js

@@ -398,7 +398,7 @@ export const directApi = {
                     host.replaceWith(err);
                     return;
                 }
-                const { resume } = await import('../../ssr/dom-ssr.js');
+                const { resume } = await import('../resume/resume.js');
                 await resume(Ctor, host, { props: resolved, state: {} });
             });
             return host;

package/dist/browser/dom-core.d.ts

@@ -12,6 +12,7 @@ export { registerComponents } from './dom/registry.js';
 export { getRegisteredComponent } from './dom/registry.js';
 export { resolveComponent } from './dom/registry.js';
 export { mount } from './dom/component.js';
+export { adoptTopLevelDomRoot } from './dom/component.js';
 export { settlePendingChildMounts } from './dom/component.js';
 export { runDirectCreate } from './dom/component.js';
 export { findOwnedDefaultSlot } from './dom/component.js';

package/dist/browser/dom-core.js

@@ -12,6 +12,7 @@ export { registerComponents } from './dom/registry.js';
 export { getRegisteredComponent } from './dom/registry.js';
 export { resolveComponent } from './dom/registry.js';
 export { mount } from './dom/component.js';
+export { adoptTopLevelDomRoot } from './dom/component.js';
 export { settlePendingChildMounts } from './dom/component.js';
 export { runDirectCreate } from './dom/component.js';
 export { findOwnedDefaultSlot } from './dom/component.js';

package/dist/browser/reactivity/write-barrier.js

@@ -71,6 +71,7 @@ export function __vmzReadPath(inst, root, segs) {
     return obj;
 }
 export function __vmzWritePathLogical(inst, root, segs, kind, rhs) {
+    assertWritePathSegs('__vmzWritePathLogical', root, segs);
     const cur = __vmzReadPath(inst, root, segs);
     if (kind === '||') {
         if (cur)
@@ -139,16 +140,26 @@ function notifyArrayItemLeaf(inst, root, idx, leaf) {
     }
     scheduleRefresh(inst, { type: 'path', root, segs: [String(idx), leaf] });
 }
+function assertWritePathSegs(fn, root, segs) {
+    if (!root)
+        return;
+    if (!Array.isArray(segs) || segs.length === 0) {
+        throw new Error(`vmz:dom ${fn} requires a non-empty path under root ${JSON.stringify(root)}; root field writes must stay plain assignments so the field setter reports them`);
+    }
+}
 export function __vmzWritePath(inst, root, segs, value) {
     if (!inst || inst.__vmzDestroyed)
         return value;
-    if (!root || !Array.isArray(segs) || segs.length === 0)
+    assertWritePathSegs('__vmzWritePath', root, segs);
+    if (!root)
         return value;
+    const normSegs = segs.map((s) => String(s));
     // Hot path: array item field write (`rows[i].label`) ??no map/slice, no shared-owner walk.
-    if (segs.length === 2) {
-        return __vmzWritePathItem(inst, root, segs[0], segs[1], value);
+    // Only a real array root takes the item fast path; a two-segment object path
+    // (`user.address.city`) must stay on the generic walk or the write is dropped.
+    if (normSegs.length === 2 && Array.isArray(inst[root])) {
+        return __vmzWritePathItem(inst, root, normSegs[0], normSegs[1], value);
     }
-    const normSegs = segs.map((s) => String(s));
     let obj = inst[root];
     if (obj == null || typeof obj !== 'object')
         return value;
@@ -192,8 +203,12 @@ export function __vmzWritePathItem(inst, root, idx, leaf, value) {
     if (!root || leaf == null)
         return value;
     const arr = inst[root];
-    if (!Array.isArray(arr))
-        return value;
+    if (!Array.isArray(arr)) {
+        // Computed member on a plain object root: same write, generic path.
+        if (arr == null || typeof arr !== 'object')
+            return value;
+        return __vmzWritePath(inst, root, [idx, leaf], value);
+    }
     const item = arr[idx];
     if (item == null || typeof item !== 'object')
         return value;
@@ -226,9 +241,10 @@ export function __vmzListTranspose(inst, root, ia, ib) {
 export function __vmzWritePathCompound(inst, root, segs, op, rhs) {
     if (!inst || inst.__vmzDestroyed)
         return undefined;
-    if (!root || !Array.isArray(segs) || segs.length === 0)
+    assertWritePathSegs('__vmzWritePathCompound', root, segs);
+    if (!root)
         return undefined;
-    if (segs.length === 2) {
+    if (segs.length === 2 && Array.isArray(inst[root])) {
         return __vmzWritePathCompoundItem(inst, root, segs[0], segs[1], op, rhs);
     }
     const cur = __vmzReadPath(inst, root, segs);
@@ -241,8 +257,12 @@ export function __vmzWritePathCompoundItem(inst, root, idx, leaf, op, rhs) {
     if (!root || leaf == null)
         return undefined;
     const arr = inst[root];
-    if (!Array.isArray(arr))
-        return undefined;
+    if (!Array.isArray(arr)) {
+        // Computed member on a plain object root: same write, generic path.
+        if (arr == null || typeof arr !== 'object')
+            return undefined;
+        return __vmzWritePathCompound(inst, root, [idx, leaf], op, rhs);
+    }
     const item = arr[idx];
     if (item == null || typeof item !== 'object')
         return undefined;
@@ -333,6 +353,9 @@ export function __vmzArrayMutate(inst, root, baseSegs, method, args) {
     }
     if (!Array.isArray(arr) || typeof arr[method] !== 'function')
         return undefined;
+    if (args !== undefined && !Array.isArray(args)) {
+        throw new Error(`vmz:dom __vmzArrayMutate expects the argument list as one array (root ${JSON.stringify(root)}, method ${JSON.stringify(method)}); stale artifacts must be rebuilt`);
+    }
     const list = Array.isArray(args) ? args : [];
     const ret = arr[method](...list);
     const rootObj = inst[root];

package/dist/browser/resume/hydrate.js

@@ -1,4 +1,4 @@
-import { applyPreservedState, createInstance, destroy, findOwnedDefaultSlot, hasMeaningfulChild, mount, runDirectCreate, settlePendingChildMounts, snapshotInstanceState, } from '../dom-core.js';
+import { adoptTopLevelDomRoot, applyPreservedState, createInstance, destroy, findOwnedDefaultSlot, hasMeaningfulChild, mount, runDirectCreate, settlePendingChildMounts, snapshotInstanceState, } from '../dom-core.js';
 import { runDirectResume } from './adopt.js';
 import { resumeIslands } from './resume.js';
 export async function hydrateRoute(Page, container, props = {}, layoutCtors = [], opts = {}) {
@@ -82,10 +82,7 @@ export async function hydrate(Component, container, props = {}, opts = {}) {
     // onMount may still patch state / redirect afterwards (same end state as SSR order).
     if (!hasMeaningfulChild(container)) {
         const node = runDirectCreate(Component, inst);
-        if (node) {
-            inst.__vmzDomRoot = node;
-            container.appendChild(node);
-        }
+        adoptTopLevelDomRoot(inst, node, container);
     }
     else {
         // Deep adopt: park SSR children, rebuild schedule, reclaim nodes (no orphan siblings).

package/dist/browser/resume/resume.js

@@ -1,5 +1,5 @@
 import { applyDirectHostBox } from '../direct-host-box.js';
-import { applyPreservedState, createInstance, destroy, hasMeaningfulChild, isEventEntryStrategy, resolveComponent, runDirectCreate, scheduleClientOn, } from '../dom-core.js';
+import { adoptTopLevelDomRoot, applyPreservedState, createInstance, destroy, hasMeaningfulChild, isEventEntryStrategy, resolveComponent, runDirectCreate, scheduleClientOn, } from '../dom-core.js';
 import { markUnknownComponentHost } from '../unknown-component.js';
 import { runDirectResume } from './adopt.js';
 export async function resume(Component, container, slice = null) {
@@ -42,10 +42,7 @@ export async function resume(Component, container, slice = null) {
     if (Component.__vmzDirect && typeof Component.__vmzCreate === 'function') {
         if (!hasMeaningfulChild(container)) {
             const node = runDirectCreate(Component, inst);
-            if (node) {
-                inst.__vmzDomRoot = node;
-                container.appendChild(node);
-            }
+            adoptTopLevelDomRoot(inst, node, container);
         }
         else {
             // Island leaf adopt: preserve Element identity (resume nodeIdentity).

package/dist/host/deployment/deployment-registry.js

@@ -97,10 +97,15 @@ export async function loadComponentEntries(distDir, opts = {}) {
 export async function importAndRegisterComponentEntries(distDir, entries, registerComponents, opts = {}) {
     const map = {};
     const loaded = opts.loaded ?? null;
+    const packNode = readPackNodeManifest(distDir);
     for (const entry of entries) {
         if (loaded && loaded.has(entry.chunkId))
             continue;
-        const abs = path.join(distDir, entry.entry);
+        // Node/SSR consumes the packed unit bytes (`_vmz/pack-node/`) whenever the
+        // build packed the node graph — bare package imports in dependency
+        // components only exist in vendored form there. Dev sessions do not pack:
+        // the unpacked `${chunkId}.client.js` remains the module identity.
+        const abs = packNode ? packNodeEntryAbs(distDir, entry, packNode) : path.join(distDir, entry.entry);
         let href = pathToFileURL(abs).href;
         if (opts.cacheBust != null && opts.cacheBust !== '') {
             href = `${href}?t=${encodeURIComponent(String(opts.cacheBust))}`;
@@ -114,6 +119,44 @@ export async function importAndRegisterComponentEntries(distDir, entries, regist
         registerComponents(map);
     return map;
 }
+/** `vmz.pack.node-manifest.v0` 的唯一消费点：缺失即未打包（dev），调用方回退未打包模块。 */
+function readPackNodeManifest(distDir) {
+    const manifestPath = path.join(distDir, '_vmz', 'pack-node-manifest.json');
+    if (!fs.existsSync(manifestPath))
+        return null;
+    // Freshness gate: `vmz build` writes the deployment document first and packs
+    // the node graph strictly after; a dev soft rebuild rewrites the deployment
+    // document without re-packing. A deployment newer than the manifest means the
+    // unpacked tree moved on — packed bytes are stale and must not be served.
+    try {
+        const deploymentMtime = fs.statSync(path.join(distDir, 'vmz-deployment.json')).mtimeMs;
+        const manifestMtime = fs.statSync(manifestPath).mtimeMs;
+        if (deploymentMtime > manifestMtime)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        return Array.isArray(parsed.entryFiles) ? { entryFiles: parsed.entryFiles } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Packed node chunk for one component entry; missing logical/file is an explicit error, never a fallback. */
+function packNodeEntryAbs(distDir, entry, manifest) {
+    const hit = manifest.entryFiles.find((e) => e && e.logical === entry.chunkId);
+    if (!hit || typeof hit.file !== 'string' || !hit.file) {
+        throw new Error(`vmz: pack-node manifest has no entry file for "${entry.chunkId}" under ${distDir}`);
+    }
+    const abs = path.join(distDir, '_vmz', 'pack-node', ...hit.file.split('/'));
+    if (!fs.existsSync(abs)) {
+        throw new Error(`vmz: pack-node chunk missing on disk for "${entry.chunkId}": ${path.relative(distDir, abs)}`);
+    }
+    return abs;
+}
 export async function bootstrapComponentRegistry(distDir, registerComponents, opts = {}) {
     const preload = opts.preload ?? (opts.closureRoots?.length ? 'closure' : 'all');
     if (preload === 'none')

package/dist/host/serve/hmr-dev.js

@@ -7,6 +7,7 @@ import { listClientComponents } from '../list-client-components.js';
 import { LOCALE_LINK_PLAN_SCHEMA, linkRouteAliasesFromUnits } from '../localize-body-links.js';
 import { loadNativeAddon } from '../native-addon.js';
 import { createRenderHost } from '../render/render-host.js';
+import { resolveRouteLayoutChain } from '../render/route-layout-chain.js';
 import { setRoutes } from '../../faces/vmz-runtime.js';
 import { LOCALE_LINK_PLAN_REL } from './constants.js';
 import { loadDeploymentStyle } from './locale-theme.js';
@@ -140,13 +141,13 @@ function emitEntryClient(eager, lazy, token) {
     }
     return native.generateServeEntryClient(eager, lazy, q);
 }
-function emitEntryEvent(token) {
+function emitEntryEvent(eager, lazy, token) {
     const q = `?t=${token}`;
     const native = loadNativeAddon();
     if (typeof native.generateServeEntryEvent !== 'function') {
         throw new Error('vmz native addon missing generateServeEntryEvent — rebuild with `pnpm napi:build`');
     }
-    return native.generateServeEntryEvent(q);
+    return native.generateServeEntryEvent(eager, lazy, q);
 }
 export async function softReload(opts = {}) {
     const prevToken = serveState.reloadToken;
@@ -237,10 +238,27 @@ export async function softReload(opts = {}) {
             .map((e) => e.component)
             .filter(Boolean);
         const lazySet = new Set(lazyEventNames);
-        await writeFile(path.join(serveState.distDir, 'entry-client.js'), emitEntryClient(componentEntries.filter((e) => !lazySet.has(e.name)), componentEntries.filter((e) => lazySet.has(e.name)), skipEntryRewrite ? serveState.reloadToken : nextToken), 'utf8');
+        const eagerComponents = componentEntries.filter((e) => !lazySet.has(e.name));
+        const lazyComponents = componentEntries.filter((e) => lazySet.has(e.name));
+        // Bootstrap tables are literal maps keyed by chunkId / island name:
+        // page/layout units must be enumerated (name = chunkId, entry =
+        // `<chunkId>.client.js`), unknown names throw at runtime by design.
+        const pageEntries = serveState.pageCatalog.map((p) => ({ name: p.chunkId, entry: `${p.chunkId}.client.js` }));
+        const layoutNames = new Set();
+        for (const p of serveState.pageCatalog) {
+            try {
+                for (const id of resolveRouteLayoutChain(serveState.distDir, p.chunkId))
+                    layoutNames.add(String(id));
+            }
+            catch {
+                /* page unit without layoutChain in a partial dev build */
+            }
+        }
+        const layoutEntries = [...layoutNames].sort().map((id) => ({ name: id, entry: `${id}.client.js` }));
+        await writeFile(path.join(serveState.distDir, 'entry-client.js'), emitEntryClient([...eagerComponents, ...pageEntries, ...layoutEntries], lazyComponents, skipEntryRewrite ? serveState.reloadToken : nextToken), 'utf8');
         const strategies = resumeEntries.map((e) => e.strategy);
         const eventOnlyShell = isEventOnlyShell(strategies);
-        await writeFile(path.join(serveState.distDir, 'entry-event.js'), emitEntryEvent(skipEntryRewrite ? serveState.reloadToken : nextToken), 'utf8');
+        await writeFile(path.join(serveState.distDir, 'entry-event.js'), emitEntryEvent([], lazyComponents, skipEntryRewrite ? serveState.reloadToken : nextToken), 'utf8');
         serveState.lastDevError = null;
         const mode = islandHmr ? 'island' : eventOnlyShell ? 'event-shell' : 'full';
         notifySse(JSON.stringify({

package/dist/host/serve/pack-entry.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Resolve the browser URL of a packed bootstrap entry from
+ * `_vmz/pack-manifest.json`.
+ *
+ * The manifest is the only logical → physical map for browser delivery. A
+ * missing manifest or a missing logical name is an explicit error: serving the
+ * unpacked root module would hand the browser bare package specifiers that only
+ * `vmz-pack` rewrites.
+ */
+export declare function packEntryHref(distDir: string, logical: string): string;

package/dist/host/serve/pack-entry.js

@@ -0,0 +1,27 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const PACK_MANIFEST_REL = ['_vmz', 'pack-manifest.json'];
+const PACK_OUTPUT_DIR_REL = ['_vmz', 'pack'];
+const DEFAULT_PUBLIC_BASE = '/';
+/**
+ * Resolve the browser URL of a packed bootstrap entry from
+ * `_vmz/pack-manifest.json`.
+ *
+ * The manifest is the only logical → physical map for browser delivery. A
+ * missing manifest or a missing logical name is an explicit error: serving the
+ * unpacked root module would hand the browser bare package specifiers that only
+ * `vmz-pack` rewrites.
+ */
+export function packEntryHref(distDir, logical) {
+    const manifestPath = path.join(distDir, ...PACK_MANIFEST_REL);
+    if (!fs.existsSync(manifestPath)) {
+        throw new Error(`packEntryHref: missing ${manifestPath} — run vmz build (pack) first`);
+    }
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    const hit = (manifest.entryFiles || []).find((entry) => entry && entry.logical === logical);
+    if (!hit || typeof hit.file !== 'string' || !hit.file) {
+        throw new Error(`packEntryHref: pack manifest has no entry file for "${logical}"`);
+    }
+    const base = String(manifest.publicBase || DEFAULT_PUBLIC_BASE).replace(/\/$/, '');
+    return `${base}/${PACK_OUTPUT_DIR_REL.join('/')}/${hit.file}`;
+}

package/dist/host/serve/page-render.js

@@ -6,6 +6,7 @@ import { extractRouteParams, findRootCatchAll, isRootCatchAll, matchFileRoute }
 import { emitDevErrorHtml, normalizeDevError } from './hmr-dev.js';
 import { cssEntryWithBust, htmlThemeAttrPair, localeBootstrapScript, pageMetaAlternates, resolveLocalePath, resolveThemeId, siteFaviconHeadHtml, themeBootstrapScript, } from './locale-theme.js';
 import { isEventOnlyShell, loadPageCtor, loadPageResumeEntries, runRouteGate } from './page-catalog.js';
+import { packEntryHref } from './pack-entry.js';
 import { serveState } from './state.js';
 export async function renderPage(pathname, opts = {}) {
     const rendered = await renderPageStream(pathname, opts);
@@ -393,7 +394,12 @@ async function* emitPageHtml(Page, chunkId, eventOnlyShell, props = {}, opts = {
     if (typeof native.generatePageShell !== 'function') {
         throw new Error('vmz native addon missing generatePageShell — rebuild with `pnpm napi:build`');
     }
-    const entrySrc = `/${eventOnlyShell ? 'entry-event.js' : 'entry-client.js'}?t=${serveState.reloadToken}`;
+    // 生产 serve 必须注入打包条目：原始 `entry-client.js` 及其拉取的客户端模块保留
+    // 裸包说明符，浏览器无法解析。dev 仍走带 token 的原始 bootstrap。
+    const entryLogical = eventOnlyShell ? 'entry-event.js' : 'entry-client.js';
+    const entrySrc = serveState.isDev
+        ? `/${entryLogical}?t=${serveState.reloadToken}`
+        : packEntryHref(serveState.distDir, entryLogical);
     const cssHref = cssEntryWithBust(serveState.cssEntry);
     yield native.generatePageShell({
         bodyHtml,

package/dist/shared/dom-attr-normalize.d.ts

@@ -1,6 +1,14 @@
 /**
  * Shared class/style normalization for Direct SSR + client (0.1.33).
  * Vue-compatible: string | string[] | object map | falsy parts.
+ *
+ * Style keys are normalized to CSS property spelling so SSR text and client
+ * patches agree: camelCase becomes kebab-case, custom properties (`--x`) pass
+ * through untouched, and names that cannot be CSS properties (whitespace, `;`,
+ * `:`, leading digit) are dropped — the same fate invalid declarations have in
+ * the browser. Numeric values gain `px` except for unitless properties, `0`,
+ * and custom properties. Array values emit repeated declarations (vendor
+ * fallback chains) and nested arrays flatten.
  */
 /** Normalize one or more class fragments into a deduped class string. */
 export declare function mergeClassParts(...parts: unknown[]): string;

package/dist/shared/dom-attr-normalize.js

@@ -1,6 +1,14 @@
 /**
  * Shared class/style normalization for Direct SSR + client (0.1.33).
  * Vue-compatible: string | string[] | object map | falsy parts.
+ *
+ * Style keys are normalized to CSS property spelling so SSR text and client
+ * patches agree: camelCase becomes kebab-case, custom properties (`--x`) pass
+ * through untouched, and names that cannot be CSS properties (whitespace, `;`,
+ * `:`, leading digit) are dropped — the same fate invalid declarations have in
+ * the browser. Numeric values gain `px` except for unitless properties, `0`,
+ * and custom properties. Array values emit repeated declarations (vendor
+ * fallback chains) and nested arrays flatten.
  */
 function pushClassTokens(out, value) {
     if (value == null || value === false)
@@ -35,37 +43,168 @@ export function mergeClassParts(...parts) {
         pushClassTokens(tokens, part);
     return [...new Set(tokens)].join(' ');
 }
-function parseStyleObject(value) {
-    const out = {};
+/** CSS properties whose numeric values stay unitless (kebab-case names). */
+const UNITLESS_STYLE_PROPS = new Set([
+    'animation-iteration-count',
+    'aspect-ratio',
+    'border-image-outset',
+    'border-image-slice',
+    'border-image-width',
+    'box-flex',
+    'box-flex-group',
+    'box-ordinal-group',
+    'column-count',
+    'columns',
+    'flex',
+    'flex-grow',
+    'flex-positive',
+    'flex-shrink',
+    'flex-negative',
+    'flex-order',
+    'grid-row',
+    'grid-row-end',
+    'grid-row-span',
+    'grid-row-start',
+    'grid-column',
+    'grid-column-end',
+    'grid-column-span',
+    'grid-column-start',
+    'font-weight',
+    'line-clamp',
+    'line-height',
+    'opacity',
+    'order',
+    'orphans',
+    'scale',
+    'tab-size',
+    'widows',
+    'z-index',
+    'zoom',
+    'fill-opacity',
+    'flood-opacity',
+    'stop-opacity',
+    'stroke-dasharray',
+    'stroke-dashoffset',
+    'stroke-miterlimit',
+    'stroke-opacity',
+    'stroke-width',
+]);
+/** camelCase → kebab-case, `--custom` preserved; `null` when not a CSS property name. */
+function normalizeStyleKey(raw) {
+    const key = raw.trim();
+    if (!key)
+        return null;
+    if (key.startsWith('--')) {
+        return /^--[\w-]+$/.test(key) ? key : null;
+    }
+    const kebab = key.replace(/\B([A-Z])/g, '-$1').toLowerCase();
+    return /^[a-z][a-z0-9-]*$/.test(kebab) ? kebab : null;
+}
+/** One style value as declaration text; `null` drops the declaration. */
+function normalizeStyleValue(key, value) {
+    if (value == null || value === false)
+        return null;
+    if (typeof value === 'number' && value !== 0 && !key.startsWith('--') && !isUnitlessStyleProp(key)) {
+        return `${value}px`;
+    }
+    return String(value);
+}
+/** Unitless lookup ignores vendor prefixes (`webkit-line-clamp` ≙ `line-clamp`). */
+function isUnitlessStyleProp(key) {
+    const unprefixed = key.replace(/^(?:-?(?:webkit|moz|ms|o))-/, '');
+    return UNITLESS_STYLE_PROPS.has(unprefixed);
+}
+function pushStyleValues(out, key, value) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            pushStyleValues(out, key, item);
+        return;
+    }
+    const text = normalizeStyleValue(key, value);
+    if (text != null)
+        out.push(text);
+}
+/**
+ * Split a style fragment on top-level `;`. Semicolons inside `url(...)` /
+ * nested parens and inside quotes (e.g. `content: 'a;b'`, data URIs with
+ * `;base64,`) do not split — a naive split would truncate those values.
+ */
+function splitStyleDeclarations(text) {
+    const chunks = [];
+    let depth = 0;
+    let quote = null;
+    let start = 0;
+    let i = 0;
+    while (i < text.length) {
+        const ch = text[i];
+        if (quote != null) {
+            if (ch === '\\') {
+                i += 2;
+                continue;
+            }
+            if (ch === quote)
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+        }
+        else if (ch === '(') {
+            depth += 1;
+        }
+        else if (ch === ')') {
+            if (depth > 0)
+                depth -= 1;
+        }
+        else if (ch === ';' && depth === 0) {
+            chunks.push(text.slice(start, i));
+            start = i + 1;
+        }
+        i += 1;
+    }
+    chunks.push(text.slice(start));
+    return chunks;
+}
+function collectStyleDeclarations(merged, value) {
     if (value == null || value === false)
-        return out;
+        return;
     if (typeof value === 'string') {
-        for (const chunk of value.split(';')) {
+        for (const chunk of splitStyleDeclarations(value)) {
             const idx = chunk.indexOf(':');
             if (idx < 0)
                 continue;
-            const key = chunk.slice(0, idx).trim();
-            const val = chunk.slice(idx + 1).trim();
-            if (key)
-                out[key] = val;
+            const key = normalizeStyleKey(chunk.slice(0, idx));
+            if (!key)
+                continue;
+            merged.set(key, [chunk.slice(idx + 1).trim()]);
         }
-        return out;
+        return;
     }
-    if (typeof value === 'object' && !Array.isArray(value)) {
-        for (const [key, raw] of Object.entries(value)) {
-            if (raw == null || raw === false)
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectStyleDeclarations(merged, item);
+        return;
+    }
+    if (typeof value === 'object') {
+        for (const [rawKey, raw] of Object.entries(value)) {
+            const key = normalizeStyleKey(rawKey);
+            if (!key)
                 continue;
-            out[key] = String(raw);
+            const values = [];
+            pushStyleValues(values, key, raw);
+            if (values.length)
+                merged.set(key, values);
         }
     }
-    return out;
 }
 /** Merge static + dynamic style fragments; later parts override same keys. */
 export function mergeStyleParts(...parts) {
-    const merged = {};
+    const merged = new Map();
     for (const part of parts)
-        Object.assign(merged, parseStyleObject(part));
-    return Object.entries(merged)
-        .map(([key, val]) => `${key}: ${val}`)
-        .join('; ');
+        collectStyleDeclarations(merged, part);
+    const out = [];
+    for (const [key, values] of merged) {
+        for (const value of values)
+            out.push(`${key}: ${value}`);
+    }
+    return out.join('; ');
 }

package/dist/ssr/onmount.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SSR `onMount` execution budget.
+ *
+ * Contract: every per-instance `onMount` await during SSR is bounded (default
+ * 5000ms, hosts may override via `opts.onMountBudgetMs`). Budget exhaustion and
+ * `signal` abort are the same event: the render terminates and fails — no
+ * half-baked HTML, no silent empty-string downgrade, no retry. An `onMount`
+ * that throws propagates its original error unchanged.
+ */
+export declare const DEFAULT_SSR_ONMOUNT_BUDGET_MS = 5000;
+/** `onMount` exceeded the SSR budget. Carries component, budget and elapsed. */
+export declare class SsrOnMountTimeoutError extends Error {
+    readonly component: string;
+    readonly budgetMs: number;
+    readonly elapsedMs: number;
+    constructor(component: string, budgetMs: number, elapsedMs: number);
+}
+/** The host signal aborted a bounded `onMount` await. */
+export declare class SsrRenderAbortError extends Error {
+    readonly component: string;
+    constructor(component: string);
+}
+export type SsrOnMountContext = {
+    budgetMs: number;
+    signal: AbortSignal | null;
+};
+/** Read the host options into a budget context (`opts.onMountBudgetMs`, `opts.signal`). */
+export declare function ssrOnMountContext(opts: any): SsrOnMountContext;
+/** Best-effort component label for diagnostics. */
+export declare function ssrComponentName(Component: any, inst: any): string;
+/**
+ * Await one instance's `onMount` under the budget. The race is settled exactly
+ * once; a late-resolving author promise after timeout/abort is dropped. The
+ * budget timer itself bounds the wait, so a hung `onMount` can never stall the
+ * host past `budgetMs`.
+ */
+export declare function awaitSsrOnMount(inst: any, component: string, ctx: SsrOnMountContext): Promise<void>;

package/dist/ssr/onmount.js

@@ -0,0 +1,94 @@
+/**
+ * SSR `onMount` execution budget.
+ *
+ * Contract: every per-instance `onMount` await during SSR is bounded (default
+ * 5000ms, hosts may override via `opts.onMountBudgetMs`). Budget exhaustion and
+ * `signal` abort are the same event: the render terminates and fails — no
+ * half-baked HTML, no silent empty-string downgrade, no retry. An `onMount`
+ * that throws propagates its original error unchanged.
+ */
+export const DEFAULT_SSR_ONMOUNT_BUDGET_MS = 5000;
+/** `onMount` exceeded the SSR budget. Carries component, budget and elapsed. */
+export class SsrOnMountTimeoutError extends Error {
+    component;
+    budgetMs;
+    elapsedMs;
+    constructor(component, budgetMs, elapsedMs) {
+        super(`vmz:ssr onMount budget exceeded: component=${component} budget=${budgetMs}ms elapsed=${elapsedMs}ms`);
+        this.name = 'SsrOnMountTimeoutError';
+        this.component = component;
+        this.budgetMs = budgetMs;
+        this.elapsedMs = elapsedMs;
+    }
+}
+/** The host signal aborted a bounded `onMount` await. */
+export class SsrRenderAbortError extends Error {
+    component;
+    constructor(component) {
+        super(`vmz:ssr onMount aborted by host signal: component=${component}`);
+        this.name = 'SsrRenderAbortError';
+        this.component = component;
+    }
+}
+/** Read the host options into a budget context (`opts.onMountBudgetMs`, `opts.signal`). */
+export function ssrOnMountContext(opts) {
+    const raw = opts && opts.onMountBudgetMs;
+    const budgetMs = Number.isFinite(raw) && Number(raw) > 0 ? Number(raw) : DEFAULT_SSR_ONMOUNT_BUDGET_MS;
+    const signal = opts && opts.signal ? opts.signal : null;
+    return { budgetMs, signal };
+}
+/** Best-effort component label for diagnostics. */
+export function ssrComponentName(Component, inst) {
+    return ((Component && (Component.__vmzTag || Component.name)) ||
+        (inst && inst.constructor && inst.constructor.name) ||
+        'AnonymousComponent');
+}
+/**
+ * Await one instance's `onMount` under the budget. The race is settled exactly
+ * once; a late-resolving author promise after timeout/abort is dropped. The
+ * budget timer itself bounds the wait, so a hung `onMount` can never stall the
+ * host past `budgetMs`.
+ */
+export async function awaitSsrOnMount(inst, component, ctx) {
+    const onMount = inst && inst.onMount;
+    if (typeof onMount !== 'function')
+        return;
+    if (ctx.signal && ctx.signal.aborted)
+        throw new SsrRenderAbortError(component);
+    const startedAt = Date.now();
+    let timer = null;
+    let onAbort = null;
+    try {
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                fn();
+            };
+            timer = setTimeout(() => {
+                settle(() => reject(new SsrOnMountTimeoutError(component, ctx.budgetMs, Date.now() - startedAt)));
+            }, ctx.budgetMs);
+            if (ctx.signal) {
+                onAbort = () => settle(() => reject(new SsrRenderAbortError(component)));
+                ctx.signal.addEventListener('abort', onAbort, { once: true });
+            }
+            let result;
+            try {
+                result = onMount.call(inst);
+            }
+            catch (err) {
+                settle(() => reject(err));
+                return;
+            }
+            Promise.resolve(result).then(() => settle(resolve), (err) => settle(() => reject(err)));
+        });
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        if (ctx.signal && onAbort)
+            ctx.signal.removeEventListener('abort', onAbort);
+    }
+}

package/dist/ssr/render.js

@@ -1,5 +1,6 @@
 import { createInstance, destroy, } from '../browser/dom-core.js';
 import { ensureSsrDocument } from './document.js';
+import { awaitSsrOnMount, ssrComponentName, ssrOnMountContext } from './onmount.js';
 import { flattenSerializeNode, runDirectSerializeTreeWithMounts, streamSerializeChunks } from './serialize.js';
 export async function renderToString(Component, props = {}, opts = {}) {
     ensureSsrDocument();
@@ -7,16 +8,15 @@ export async function renderToString(Component, props = {}, opts = {}) {
     if (signal && signal.aborted)
         return '';
     const inst = createInstance(Component, props);
-    if (typeof inst.onMount === 'function') {
-        await inst.onMount();
-    }
+    const onMountCtx = ssrOnMountContext(opts);
+    await awaitSsrOnMount(inst, ssrComponentName(Component, inst), onMountCtx);
     if (signal && signal.aborted)
         return '';
     // production Direct emit: SSR only via Direct serialize schedule ??never `render`.
     if (!(Component && Component.__vmzDirect && typeof Component.__vmzCreate === 'function')) {
         throw new Error(`vmz:dom renderToString() requires __vmzCreate (Direct); blueprint render() removed (production Direct emit)`);
     }
-    const root = await runDirectSerializeTreeWithMounts(Component, inst);
+    const root = await runDirectSerializeTreeWithMounts(Component, inst, onMountCtx);
     if (opts && opts.slotHtml != null)
         injectDefaultSlotHtml(root, opts.slotHtml);
     return flattenSerializeNode(root);
@@ -29,15 +29,14 @@ export async function* renderToStream(Component, props = {}, opts = {}) {
         return;
     const inst = createInstance(Component, props);
     try {
-        if (typeof inst.onMount === 'function') {
-            await inst.onMount();
-        }
+        const onMountCtx = ssrOnMountContext(opts);
+        await awaitSsrOnMount(inst, ssrComponentName(Component, inst), onMountCtx);
         if (aborted())
             return;
         if (!(Component && Component.__vmzDirect && typeof Component.__vmzCreate === 'function')) {
             throw new Error(`vmz:dom renderToStream() requires __vmzCreate (Direct); blueprint render() removed (production Direct emit)`);
         }
-        const root = await runDirectSerializeTreeWithMounts(Component, inst);
+        const root = await runDirectSerializeTreeWithMounts(Component, inst, onMountCtx);
         if (opts && opts.slotHtml != null)
             injectDefaultSlotHtml(root, opts.slotHtml);
         if (aborted())

package/dist/ssr/serialize.d.ts

@@ -1,3 +1,3 @@
-export declare function runDirectSerializeTreeWithMounts(Component: any, inst: any): Promise<any>;
+export declare function runDirectSerializeTreeWithMounts(Component: any, inst: any, onMountCtx?: any): Promise<any>;
 export declare function flattenSerializeNode(node: any): any;
 export declare function streamSerializeChunks(node: any): any;

package/dist/ssr/serialize.js

@@ -2,6 +2,7 @@ import { directHostBoxStyleAttr } from '../browser/direct-host-box.js';
 import { BOOLEAN_HTML_ATTRS, createInstance, eventPropHandlerName, getRegisteredComponent, isEventEntryStrategy, mergeClassParts, mergeStyleParts, snapshotInstanceState, stripFns, } from '../browser/dom-core.js';
 import { serializeUnknownComponentNode } from '../browser/unknown-component.js';
 import { _ssrDocumentLastError, ensureSsrDocument } from './document.js';
+import { awaitSsrOnMount, ssrComponentName, ssrOnMountContext } from './onmount.js';
 function runDirectSerializeTree(Component, inst) {
     serializeApi._inst = inst;
     try {
@@ -11,7 +12,8 @@ function runDirectSerializeTree(Component, inst) {
         serializeApi._inst = null;
     }
 }
-export async function runDirectSerializeTreeWithMounts(Component, inst) {
+export async function runDirectSerializeTreeWithMounts(Component, inst, onMountCtx) {
+    const ctx = onMountCtx || ssrOnMountContext(null);
     let preMounted = [];
     let tree = null;
     for (let round = 0; round < 32; round++) {
@@ -28,9 +30,7 @@ export async function runDirectSerializeTreeWithMounts(Component, inst) {
         if (!collected.length)
             return tree;
         for (const child of collected) {
-            if (typeof child.onMount === 'function') {
-                await child.onMount();
-            }
+            await awaitSsrOnMount(child, ssrComponentName(null, child), ctx);
         }
         preMounted = preMounted.concat(collected);
     }

package/package.json

@@ -68,12 +68,12 @@
   "main": "./dist/faces/server.js",
   "name": "@vmz/core",
   "optionalDependencies": {
-    "@vmz/vmz-darwin-arm64": "0.3.12",
-    "@vmz/vmz-darwin-x64": "0.3.12",
-    "@vmz/vmz-linux-arm64": "0.3.12",
-    "@vmz/vmz-linux-x64": "0.3.12",
-    "@vmz/vmz-win32-arm64": "0.3.12",
-    "@vmz/vmz-win32-x64": "0.3.12"
+    "@vmz/vmz-darwin-arm64": "0.3.13",
+    "@vmz/vmz-darwin-x64": "0.3.13",
+    "@vmz/vmz-linux-arm64": "0.3.13",
+    "@vmz/vmz-linux-x64": "0.3.13",
+    "@vmz/vmz-win32-arm64": "0.3.13",
+    "@vmz/vmz-win32-x64": "0.3.13"
   },
   "publishConfig": {
     "access": "public"
@@ -88,5 +88,5 @@
   },
   "type": "module",
   "types": "./dist/faces/index.d.ts",
-  "version": "0.3.12"
+  "version": "0.3.13"
 }